Technical Infrastructure
& Record Sovereignty

We do not access customer records in the course of ordinary operations. Access occurs only in two circumstances: a support request you raise, or an urgent availability or integrity incident.

Administrative access is gated behind an explicit superadmin check in the application layer, tied to a single named account rather than a shared credential. Anyone granted this access agrees in writing to keep customer data confidential.

Current gap, stated plainly: customer-visible logging of individual support-access events into your own audit chain is on our roadmap, not yet built. Today, administrative access is constrained by RLS and service-role scoping (see above) and by infrastructure-level logging at Supabase and Vercel, not by a tenant-facing access log.

Every organisation that touches customer data in the course of running PsychProof, current as of this page’s last update below:

We will notify customers before adding a new sub-processor. Last updated: 23 July 2026.

We scrub before we send. Free-text fields are never dispatched to an LLM as-typed. Every AI call site runs the same server-side pipeline first: named-entity redaction (people, places, organisations) followed by pattern-based redaction of emails, phone numbers, URLs, and Australian Business/Company Numbers. What is actually sent (and whether it differed from the original) is logged as a SHA-256 hash pair, never as content, and is visible to us in an internal audit log. Nothing here relies on the AI provider to behave; the redaction happens before the network call.

Human decision authority. The AI never makes a determination. Every suggestion is attributable and overridable, and both the suggestion and the override are recorded.

Where inference happens. PsychProof calls Anthropic’s Claude API as the default provider for AI-assisted features (hazard triage, drafting support), with Google’s Gemini API used only for embeddings and search-grounded discovery. We are confirming and will publish the exact data-retention and training-use terms for each provider’s commercial API tier; we do not want to state “no training” as a blanket claim until that is verified in writing for both.

On-premises / local inference. Not available today. If this matters for your deployment, tell us: it is the kind of requirement that changes our roadmap priority.

Role-based access control is enforced today: owner / admin / whs_officer / manager / member / external_advisor, with elevated roles requiring explicit approval before they take effect.

Deprovisioning: deactivating a user blocks their access on their very next request, checked server-side on every page load, not on next login.

Multi-factor authentication is in active development and not yet enforceable in production. SSO (SAML / OIDC) is not yet built. Both are roadmap items rather than available controls. We would rather say that plainly than list them as shipped.

Automated encrypted backups are taken by our infrastructure provider and stored in Australia. We are finalising and will publish the exact frequency, retention window, and tested recovery objectives (RPO/RTO) rather than quote figures we have not verified end-to-end.

The part that matters most for a small vendor: you may export your complete record set at any time, in open formats, including the cryptographic hashes and RFC 3161 timestamp tokens. Because those timestamps come from an independent external authority, not from us, your exported evidence remains verifiable without any PsychProof system running at all.

We maintain an internal incident response procedure covering triage, root-cause analysis (software defect vs. malicious activity), and resolution, including a rule we treat as absolute: audit-chain records are never deleted, only ever extended with a documented, dated correction event.

Where an incident is likely to result in serious harm, we will notify affected customers without undue delay, with the technical facts you need to meet your own obligations under the Notifiable Data Breaches scheme. As the entity holding the employment relationship, you retain the notification obligation to your employees. We provide the facts, promptly and completely.

Report a vulnerability: security@psychproof.com.au.

Ownership. Your records are yours. We claim no right to use them for any purpose other than providing the service.

Export. Full export in open formats at any time, including verification artifacts.

The integrity exception, stated honestly: once a record is cryptographically sealed, it cannot be silently altered or removed from the hash chain: that immutability is precisely what makes it evidence. Deleting a sealed record is recorded as a deletion event rather than an erasure of history. We will explain this interaction with erasure requests in writing before you deploy, particularly where it intersects with your own retention and privacy obligations.

Sentinel’s aggregate views enforce numeric minimum-group thresholds before any pattern is shown: a minimum of 5 distinct respondents before any raw percentage is disclosed, and a minimum of 3 before a categorical pattern is shown at all. Below either threshold, the view is suppressed, not approximated.

Whether specific psychosocial data constitutes health information under the Privacy Act (which carries a higher consent standard) is a question we are routing to written legal advice rather than answering from our own judgment. The same applies to reliance on the employee records exemption, which is narrower than most employers assume.

Dependency vulnerabilities are audited and patched on a rolling basis: our most recent sweep resolved 24 flagged packages, high/critical severity addressed first. The application is developed against the OWASP Application Security Verification Standard (ASVS) Level 2 as a structured benchmark, with a self-assessment available on request.

Independent third-party penetration testing is not yet completed. Our public position: a formal engagement within 90 days of first enterprise deployment, with a summary report available to customers under NDA.

Responsible disclosure: security@psychproof.com.au.